7.8

CVE-2023-41902

An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by crafting malicious .pkg files.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Corecode ≫ Macupdater Version < 2.3.8
Corecode ≫ Macupdater Version >= 3.0.0 < 3.1.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.22% 0.125
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

https://gist.github.com/NSEcho/5d048a0796ceef59d6b1df1659bd1057
Third Party Advisory
https://www.corecode.io/macupdater/history2.html
Release Notes
https://www.corecode.io/macupdater/history3.html
Release Notes